One example of a value printing system is a postage evidencing system including an electronic postage meter and a printer for printing a postal indicia on an envelope or other mail piece. Electronic postage meters for dispensing postage and accounting for the amount of postage used are well known in the art. The meter supplies evidence of the postage dispensed by printing indicia which indicates the value of the postage on an envelope or the like. The typical postage meter stores accounting information concerning its usage in a variety of registers. An ascending register tracks the total amount of postage dispensed by the meter over its lifetime by being incremented in the amount of the postage dispensed after each transaction. A descending register tracks the amount of postage available for use. Thus, the descending register is decremented by the amount of postage dispensed after each transaction. When the descending register has been decremented to some value insufficient for dispensing postage, the postage meter inhibits further printing of indicia until the descending register is refilled with funds.
In a closed postage metering system, the system functionality is solely dedicated to metering activity. As defined by the United States Postal Service (USPS), a closed system is a system whose basic components are dedicated to the production of information-based indicia and related functions, similar to an existing, traditional postage meter. A closed system, which may be a proprietary device used alone or in conjunction with other closely related, specialized equipment, includes the indicia print mechanism. Thus, the postage meter and the printer have traditionally been located within a single secure housing. In this environment, the communications between the postage meter and the printer are typically physically secure. However, efforts have been undertaken to provide a closed postage metering system in which the postage meter is removable from a base that houses the printer. Thus, the meter and printer are physically separable from each other and are no longer contained within the same secure housing, making the physical communication lines between the postage meter and the printer generally non-secure.
There are problems, however, with mailing machines in which the meter is physically separable from the printer. For example, since the communication link between the meter and printer is not physically secure, the communication link is vulnerable to attack by unscrupulous people attempting to defraud the postal authority of funds. For example, one type of attack is referred to as a replay attack. In a replay attack, a monitoring/recording device, such as, for example, a personal computer or other device capable of monitoring and recording the data, e.g., an indicium message, being sent between the meter and printer, is inserted between the meter and printer. Such insertion can typically be performed by splicing into or otherwise altering the communication link. When a mail run is performed, the recording device logs all indicium messages, i.e., the data representative of postage indicium, generated by the meter that is being sent to the printer and then forwards the indicium message to the printer. The printer will process the indicium message and print the corresponding indicium onto a mail piece. Once the mail run is complete, the recorded data can then be replayed to the printer and the same indicium or indicia will be printed again, as the printer is unaware that the indicia data is not coming directly from the meter and is a recording of data previously processed. Thus, the indicium data could be replayed multiple times, with postage being accounted for and paid only once, i.e., for the initial mail run that was recorded by the recording device.
For example, a mail run of 2000 pieces could be separated into two 1000 piece batches. The first batch could be processed by the mailing machine, and the indicium data for each piece recorded by a recording device. The second batch could then be processed by replaying the recorded indicium data for the first batch, and printing duplicate indicium. The accounting will thus have only occurred for the first batch, thereby defrauding the postal authority of the funds for the second batch. Additionally, the recorded messages could be replayed multiple times, thereby further defrauding the postal authority of the funds for the mail pieces marked with the duplicate indicia.
It would be desirous to be able to protect against such replay attacks, thereby providing security to prevent the stealing of funds and/or services from the postal authority. Thus, there exists a need for a method and system that protects against a replay attack in a closed system postage meter.